stackscan 2.7.2__py3-none-any.whl → 2.7.3__py3-none-any.whl

stackscan/__init__.py

@@ -2,4 +2,4 @@ from .core import StackscanSession
 from .utils import normalize_url
 
 __all__ = ["StackscanSession", "__version__", "normalize_url"]
-__version__ = "2.7.2"
+__version__ = "2.7.3"

stackscan/analyzers/cve.py

@@ -101,6 +101,16 @@ _GENERATOR_RE = re.compile(
     "<meta[^>]+name=[\\\"']generator[\\\"'][^>]+content=[\\\"']([^\\\"']+)[\\\"']", re.IGNORECASE
 )
 _SSH_RE = re.compile(r"openssh[\s_/:-](\d+\.\d+(?:p\d+)?)", re.IGNORECASE)
+_VERSION_PREFIX_RE = re.compile(r"\s*[vV]?\d+\.\d")
+_IMPRECISE_VERSION_RE = re.compile(
+    r"\b(?:or|and) (?:later|higher|earlier|newer|above|below|greater)\b", re.IGNORECASE
+)
+
+
+def _usable_port_version(version: str) -> bool:
+    if not _VERSION_PREFIX_RE.match(version):
+        return False
+    return not _IMPRECISE_VERSION_RE.search(version)
 _CORE_COMMIT_RE = re.compile(
     r"([A-Za-z][A-Za-z0-9\s-]*?)\s+Core\s+\(([a-f0-9]{4,})\)", re.IGNORECASE
 )
@@ -276,7 +286,7 @@ def software_from_ports(scan: PortScan | None) -> list[Software]:
                 )
             )
             continue
-        if port.product and port.version:
+        if port.product and port.version and _usable_port_version(port.version):
             out.append(
                 Software(
                     name=port.product.lower().split()[0],
@@ -294,6 +304,11 @@ _SEVERITY_RANK = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
 
 
 def _confidence(version: str, rng: dict[str, str], source: str, backported: bool = False) -> int:
+    if source.startswith("body-text:"):
+        # a bare "name version" scraped from page prose (e.g. a blog post),
+        # not a live banner — kept below the default threshold so it is hidden
+        # unless the user asks for low-confidence matches.
+        return 30
     if backported:
         if "start_incl" in rng or "start_excl" in rng:
             return 35
@@ -337,8 +352,16 @@ def _match_entries(
         return
     if is_commit_hash(version):
         return
+    if len([c for c in re.split("[.\\-_]", version) if c[:1].isdigit()]) < 2:
+        return
+    from_prose = item.source.startswith("body-text:")
     backported = bool(item.os)
-    caveat = "distro backport likely — patchlevel not in banner" if backported else ""
+    if from_prose:
+        caveat = "version mentioned in page text — may not be the running software"
+    elif backported:
+        caveat = "distro backport likely — patchlevel not in banner"
+    else:
+        caveat = ""
     for entry in entries:
         ranges = cast("list[dict[str, str]]", entry.get("ranges") or [])
         hit_rng = next((r for r in ranges if _in_range(version, r)), None)
@@ -357,7 +380,7 @@ def _match_entries(
                 confidence=confidence,
                 summary=str(entry.get("summary", "")),
                 url=entry.get("url"),
-                unconfirmed=backported,
+                unconfirmed=backported or from_prose,
                 caveat=caveat,
             )
             agg[cve_id] = record

stackscan/analyzers/exposure.py

@@ -18,6 +18,26 @@ class ExposureProbe:
     insecure: bool
 
 
+def _looks_like_robots(body: str) -> bool:
+    lowered = body.lower()
+    return any(
+        directive in lowered
+        for directive in ("user-agent:", "disallow:", "allow:", "sitemap:", "crawl-delay:")
+    )
+
+
+def _looks_like_sitemap(body: str) -> bool:
+    lowered = body.lstrip().lower()
+    return lowered.startswith("<?xml") or "<urlset" in lowered or "<sitemapindex" in lowered
+
+
+def _looks_like_security_txt(body: str) -> bool:
+    lowered = body.lower()
+    return any(
+        field in lowered for field in ("contact:", "expires:", "encryption:", "acknowledgments:")
+    )
+
+
 async def _get(session: StackscanSession, url: str, probe: ExposureProbe) -> tuple[int | None, str]:
     try:
         result = await session.fetch(
@@ -39,20 +59,20 @@ async def analyze_exposure(
     urls: dict[str, str] = {}
 
     robots_url = urljoin(base_url, "/robots.txt")
-    robots_status, _ = await _get(session, robots_url, probe)
-    robots = robots_status == 200
+    robots_status, robots_body = await _get(session, robots_url, probe)
+    robots = robots_status == 200 and _looks_like_robots(robots_body)
     if robots:
         urls["robots.txt"] = robots_url
 
     sitemap_url = urljoin(base_url, "/sitemap.xml")
-    sitemap_status, _ = await _get(session, sitemap_url, probe)
-    sitemap = sitemap_status == 200
+    sitemap_status, sitemap_body = await _get(session, sitemap_url, probe)
+    sitemap = sitemap_status == 200 and _looks_like_sitemap(sitemap_body)
     if sitemap:
         urls["sitemap.xml"] = sitemap_url
 
     sec_url = urljoin(base_url, "/.well-known/security.txt")
-    sec_status, _ = await _get(session, sec_url, probe)
-    security_txt = sec_status == 200
+    sec_status, sec_body = await _get(session, sec_url, probe)
+    security_txt = sec_status == 200 and _looks_like_security_txt(sec_body)
     if security_txt:
         urls["security.txt"] = sec_url
 

stackscan/analyzers/generic.py

@@ -93,7 +93,7 @@ _POWERED_BY_PLAIN_RE = re.compile(
 _SERVER_VERSION_RE = re.compile(
     r"\b("
     + "|".join(re.escape(name) for name in sorted(SERVER_NAMES, key=len, reverse=True))
-    + r")[/ ]v?(\d+\.\d+(?:\.\d+){0,2})",
+    + r")([/ ])v?(\d+\.\d+(?:\.\d+){0,2})",
     re.IGNORECASE,
 )
 
@@ -155,6 +155,11 @@ def _software_name(name: str) -> str:
     return _normalize_name(name).lower().replace(" ", "")
 
 
+def _name_detached_from_version(name: str) -> bool:
+    """True when the version sits behind a stopword/other product, not this name."""
+    return _software_name(_clean_product_name(name)) != _software_name(name)
+
+
 def _category(name: str) -> str:
     if _software_name(name) in {n.replace(" ", "") for n in SERVER_NAMES}:
         return "infrastructure"
@@ -195,16 +200,18 @@ def extract_generic_tech(body: str) -> list[Technology]:
 
     for match in _SERVER_VERSION_RE.finditer(body):
         name = _normalize_name(match.group(1))
-        version = match.group(2)
-        remember(name, f"body:{name}/{version}", version)
+        version = match.group(3)
+        source = f"body:{name}/{version}" if match.group(2) == "/" else f"body-text:{name} {version}"
+        remember(name, source, version)
 
     powered_starts: set[int] = set()
     for match in _POWERED_BY_VERSION_RE.finditer(body):
         name = _normalize_name(match.group(1))
-        version = match.group(2)
+        version = match.group(2) if not _name_detached_from_version(name) else None
         powered_starts.add(match.start())
         if name and not _is_noise(name):
-            remember(name, f"body:powered-by {name} {version}", version)
+            evidence = f"body:powered-by {name} {version}" if version else f"body:powered-by {name}"
+            remember(name, evidence, version)
 
     for match in _POWERED_BY_PLAIN_RE.finditer(body):
         if match.start() in powered_starts:
@@ -275,16 +282,18 @@ def extract_generic_software(body: str, location: str = "") -> list[Software]:
 
     for match in _SERVER_VERSION_RE.finditer(body):
         name = _normalize_name(match.group(1))
-        version = match.group(2)
-        add(name, version, f"body:{name}/{version}")
+        version = match.group(3)
+        source = f"body:{name}/{version}" if match.group(2) == "/" else f"body-text:{name} {version}"
+        add(name, version, source)
 
     powered_starts: set[int] = set()
     for match in _POWERED_BY_VERSION_RE.finditer(body):
         name = _normalize_name(match.group(1))
-        version = match.group(2)
+        version = match.group(2) if not _name_detached_from_version(name) else None
         powered_starts.add(match.start())
         if name:
-            add(name, version, f"body:powered-by {name} {version}")
+            evidence = f"body:powered-by {name} {version}" if version else f"body:powered-by {name}"
+            add(name, version, evidence)
 
     for match in _POWERED_BY_PLAIN_RE.finditer(body):
         if match.start() in powered_starts:

stackscan/cli.py

@@ -10,9 +10,10 @@ from collections.abc import Iterable
 from datetime import UTC, datetime
 from functools import lru_cache
 from pathlib import Path
-from typing import Any
+from typing import Any, cast
 
 from rich.console import Console
+from rich.markup import escape
 from rich.progress import Progress
 from rich.table import Table
 
@@ -362,7 +363,7 @@ def _bar(label: str, total: int | None = None) -> Any:
     if _reekeer_progress is None:
         return None
     try:
-        return _reekeer_progress.bar(label, total=total)
+        return cast("Any", _reekeer_progress).bar(label, total=total)
     except Exception:
         # Reporting progress is not what stackscan is for. It must never be the reason a scan fails.
         return None
@@ -710,13 +711,13 @@ def _render_table(reports: list[ScanReport], show_empty: bool) -> None:
             ips.extend(report.network.ipv4)
             ips.extend(report.network.ipv6)
         table.add_row(
-            report.final_url or report.url,
-            ", ".join(ips) if ips else "-",
+            escape(report.final_url or report.url),
+            escape(", ".join(ips)) if ips else "-",
             str(report.status) if report.status is not None else "-",
-            _infra_summary(report),
-            _format_detected(report.by_category()),
+            escape(_infra_summary(report)),
+            escape(_format_detected(report.by_category())),
             _exposure_summary(report),
-            report.error or "",
+            escape(report.error or ""),
         )
     console.print(table)
 
@@ -817,11 +818,11 @@ def _scan_summary(reports: list[ScanReport], elapsed: float) -> str:
 
 
 def _warn(console: Console, message: str) -> None:
-    console.print(f"[{theme.WARN}]{_glyphs().warn}[/] {message}", highlight=False)
+    console.print(f"[{theme.WARN}]{_glyphs().warn}[/] {escape(message)}", highlight=False)
 
 
 def _error(console: Console, message: str) -> None:
-    console.print(f"[{theme.DANGER}]{_glyphs().err}[/] {message}", highlight=False)
+    console.print(f"[{theme.DANGER}]{_glyphs().err}[/] {escape(message)}", highlight=False)
 
 
 def _set_title(title: str) -> None:

stackscan/config/sources.py

@@ -83,8 +83,18 @@ def _looks_like_git(url: str) -> bool:
     return url.endswith(".git") or url.startswith(("git@", "git+", "ssh://"))
 
 
+_GIT_SCHEMES = ("https://", "http://", "ssh://", "git://", "file://")
+
+
 def _normalize_git_url(url: str) -> str:
-    return url[4:] if url.startswith("git+") else url
+    normalized = url[4:] if url.startswith("git+") else url
+    if normalized.startswith("git@") or normalized.startswith(_GIT_SCHEMES):
+        return normalized
+    if "://" not in normalized and "::" not in normalized:
+        expanded = Path(normalized).expanduser()
+        if expanded.exists():
+            return str(expanded)
+    raise SourceError(f"unsupported git url: {url}")
 
 
 def _detect_kind(url: str) -> str:
@@ -385,7 +395,7 @@ def _materialize_git(url: str, dest: Path) -> _Materialized:
     clone_url = _normalize_git_url(url)
     try:
         subprocess.run(
-            ["git", "clone", "--depth", "1", clone_url, str(checkout)],
+            ["git", "clone", "--depth", "1", "--", clone_url, str(checkout)],
             check=True,
             capture_output=True,
             text=True,

stackscan/core/core.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import codecs
 from collections.abc import Iterable
 
 from aiohttp import ClientSession, ClientTimeout
@@ -7,11 +8,23 @@ from aiohttp import ClientSession, ClientTimeout
 from stackscan.net.resolver import build_connector
 from stackscan.types import FetchResult
 
+_MAX_DRAIN_BYTES = 4 * 1024 * 1024
+
 
 def _lower_headers(items: Iterable[tuple[str, str]]) -> dict[str, str]:
     return {key.lower(): value for key, value in items}
 
 
+def _charset(declared: str | None) -> str:
+    if not declared:
+        return "utf-8"
+    try:
+        codecs.lookup(declared)
+    except LookupError:
+        return "utf-8"
+    return declared
+
+
 class StackscanSession:
     def __init__(self) -> None:
         self._session: ClientSession | None = None
@@ -54,10 +67,14 @@ class StackscanSession:
             headers = _lower_headers(header_items)
             raw_headers = [f"{key.lower()}: {value}" for key, value in header_items]
             cookies = resp.headers.getall("Set-Cookie", [])
-            charset = resp.charset or "utf-8"
+            charset = _charset(resp.charset)
             body_bytes = await resp.content.read(max_bytes)
-            while await resp.content.read(8192):
-                pass
+            drained = 0
+            while drained < _MAX_DRAIN_BYTES:
+                chunk = await resp.content.read(8192)
+                if not chunk:
+                    break
+                drained += len(chunk)
             body = body_bytes.decode(charset, errors="replace")
             url_final = str(resp.url)
             version = resp.version

stackscan/export.py

@@ -27,6 +27,15 @@ def to_json(payload: Payload) -> str:
     return json.dumps(payload, ensure_ascii=False, indent=2)
 
 
+def _script_json(value: Any) -> str:
+    return (
+        json.dumps(value, ensure_ascii=False)
+        .replace("<", "\\u003c")
+        .replace(">", "\\u003e")
+        .replace("&", "\\u0026")
+    )
+
+
 def build_graph(reports: list[dict[str, Any]]) -> dict[str, Any]:
     nodes: dict[str, dict[str, Any]] = {}
     edges: set[tuple[str, str, str]] = set()
@@ -407,7 +416,7 @@ def _html_graph(reports: list[dict[str, Any]]) -> str:
     if len(present_types) < 2:
         return ""
 
-    graph_json = json.dumps(
+    graph_json = _script_json(
         {
             "nodes": [
                 {
@@ -420,8 +429,7 @@ def _html_graph(reports: list[dict[str, Any]]) -> str:
                 for n in graph["nodes"]
             ],
             "edges": graph["edges"],
-        },
-        ensure_ascii=False,
+        }
     )
 
     legend_items = "".join(
@@ -438,7 +446,7 @@ def _html_graph(reports: list[dict[str, Any]]) -> str:
 </div>
 <script>
 (function(){{
-  const colors = {json.dumps(type_color)};
+  const colors = {_script_json(type_color)};
   const data = {graph_json};
   const svg = document.getElementById('netgraph');
   const viewport = svg.querySelector('.graph-viewport');
@@ -493,8 +501,14 @@ def _html_graph(reports: list[dict[str, Any]]) -> str:
   }}
 
   function showTip(ev, n) {{
-    const meta = Object.entries(n.meta || {{}}).map(([k,v]) => `${{k}}: ${{v}}`).join('<br>');
-    tooltip.innerHTML = `<strong>${{n.label}}</strong> (${{n.type}})${{meta ? '<br>' + meta : ''}}`;
+    const strong = document.createElement('strong');
+    strong.textContent = n.label;
+    const parts = [strong, document.createTextNode(` (${{n.type}})`)];
+    Object.entries(n.meta || {{}}).forEach(([k, v]) => {{
+      parts.push(document.createElement('br'));
+      parts.push(document.createTextNode(`${{k}}: ${{v}}`));
+    }});
+    tooltip.replaceChildren(...parts);
     tooltip.style.opacity = 1;
     moveTip(ev);
   }}

stackscan/net/fingerprint.py

@@ -92,6 +92,16 @@ def fingerprint_http(raw_response: str) -> tuple[str | None, str | None]:
     return (server, None)
 
 
+def normalize_mysql_version(product: str | None, version: str) -> tuple[str, str, str]:
+    distro = extract_distro(version) or ""
+    if version.startswith("5.5.5-"):
+        version = version[6:]
+        product = "MariaDB"
+    elif "mariadb" in version.lower():
+        product = "MariaDB"
+    return (product or "MySQL", version.split("-", 1)[0] or version, distro)
+
+
 def fingerprint_mysql(data: bytes) -> tuple[str | None, str | None, str | None, bool]:
     if not data or len(data) < 5:
         return (None, None, None, False)
@@ -108,13 +118,5 @@ def fingerprint_mysql(data: bytes) -> tuple[str | None, str | None, str | None,
     version = version.replace("\x00", "").strip()
     if not version:
         return (None, None, None, False)
-    if version.startswith("5.5.5-"):
-        version = version[6:]
-        product = "MariaDB"
-    elif "mariadb" in version.lower():
-        product = "MariaDB"
-    else:
-        product = "MySQL"
-    clean_version = version.split("-", 1)[0]
-    distro = extract_distro(version)
-    return (product, clean_version, distro, False)
+    product, clean_version, distro = normalize_mysql_version(None, version)
+    return (product, clean_version, distro or None, False)

stackscan/net/ports.py

@@ -8,6 +8,7 @@ from stackscan.net.fingerprint import (
     fingerprint_banner,
     fingerprint_http,
     fingerprint_mysql,
+    normalize_mysql_version,
     sanitize_banner,
 )
 from stackscan.types import Port, PortScan
@@ -108,9 +109,9 @@ def _run_nmap(host: str, ports: tuple[int, ...]) -> PortScan | None:
                 continue
             product = info.get("product") or None
             version = info.get("version") or None
-            extra = info.get("extrainfo") or None
-            if extra and version:
-                version = f"{version} ({extra})"
+            os_tag = ""
+            if version and (product or "").lower() in ("mysql", "mariadb"):
+                product, version, os_tag = normalize_mysql_version(product, version)
             found.append(
                 Port(
                     port=int(number),
@@ -120,6 +121,7 @@ def _run_nmap(host: str, ports: tuple[int, ...]) -> PortScan | None:
                     product=product,
                     version=version,
                     host=host,
+                    os=os_tag,
                 )
             )
     found.sort(key=lambda p: p.port)
@@ -227,9 +229,10 @@ async def _http_probe(
         await asyncio.wait_for(writer.drain(), timeout=min(timeout, 2.5))
     except (TimeoutError, OSError):
         return (None, None, "")
-    raw = await _read(reader, timeout)
-    if not raw:
+    data = await _read_bytes(reader, timeout)
+    if not data:
         return (None, None, "")
+    raw = data.decode("utf-8", "replace")
     product, version = fingerprint_http(raw)
     os = _os_from_banner(raw)
     return (product, version, os)
@@ -244,10 +247,10 @@ async def _rtsp_probe(
         await asyncio.wait_for(writer.drain(), timeout=min(timeout, 2.5))
     except (TimeoutError, OSError):
         return (None, None)
-    raw = await _read(reader, timeout)
-    if not raw:
+    data = await _read_bytes(reader, timeout)
+    if not data:
         return (None, None)
-    server = fingerprint_http(raw)
+    server = fingerprint_http(data.decode("utf-8", "replace"))
     if server != (None, None):
         return server
     return ("RTSP", None)

stackscan/render.py

@@ -8,6 +8,7 @@ from functools import lru_cache
 from urllib.parse import urljoin
 
 from rich.console import Console, Group, RenderableType
+from rich.markup import escape
 from rich.panel import Panel
 from rich.table import Table
 from rich.text import Text
@@ -144,7 +145,7 @@ def _network_section(report: ScanReport) -> RenderableType | None:
         ttl = ""
         if rrtype in dns_ttl:
             ttl = str(dns_ttl[rrtype])
-        table.add_row(rrtype, target, value, ttl)
+        table.add_row(rrtype, escape(target), escape(value), ttl)
     return table
 
 
@@ -159,7 +160,7 @@ def _whois_section(report: ScanReport) -> RenderableType | None:
     if registrar and whois.registrar_url:
         registrar += f"  ·  {whois.registrar_url}"
     if registrar:
-        grid.add_row("Registrar", registrar)
+        grid.add_row("Registrar", escape(registrar))
     if whois.registrant_public and whois.registrant:
         grid.add_row("Registrant", Text(whois.registrant, style=theme.WARN))
     elif whois.privacy:
@@ -172,9 +173,9 @@ def _whois_section(report: ScanReport) -> RenderableType | None:
     if whois.expires:
         dates.append(f"expires {whois.expires[:10]}")
     if dates:
-        grid.add_row("Dates", "  ·  ".join(dates))
+        grid.add_row("Dates", escape("  ·  ".join(dates)))
     if whois.nameservers:
-        grid.add_row("Nameservers", ", ".join(whois.nameservers))
+        grid.add_row("Nameservers", escape(", ".join(whois.nameservers)))
     if whois.dnssec:
         style = theme.SUCCESS if whois.dnssec == "signed" else theme.MUTED
         grid.add_row("DNSSEC", Text(whois.dnssec, style=style))
@@ -270,7 +271,7 @@ def _tls_section(report: ScanReport) -> RenderableType | None:
         issued_by = _issuer_org(tls.issuer)
         if ca_kind:
             issued_by += f"  ·  {ca_kind}"
-        grid.add_row("Issued by", issued_by)
+        grid.add_row("Issued by", escape(issued_by))
     expiry = _cert_expiry(tls.not_after)
     if expiry is not None:
         grid.add_row("Expires", expiry)
@@ -278,14 +279,14 @@ def _tls_section(report: ScanReport) -> RenderableType | None:
         grid.add_row("Issued", Text(tls.not_before, style=theme.MUTED))
     proto = " ".join(filter(None, (tls.protocol, tls.cipher)))
     if proto:
-        grid.add_row("Cipher", proto)
+        grid.add_row("Cipher", escape(proto))
     if tls.alpn:
-        grid.add_row("ALPN", tls.alpn)
+        grid.add_row("ALPN", escape(tls.alpn))
     if tls.subject_alt_names:
         sans = ", ".join(tls.subject_alt_names[:8])
         if len(tls.subject_alt_names) > 8:
             sans += f" (+{len(tls.subject_alt_names) - 8} more)"
-        grid.add_row("SANs", sans)
+        grid.add_row("SANs", escape(sans))
     if report.protocols:
         grid.add_row("HTTP", "  ·  ".join(report.protocols))
     if not grid.row_count:
@@ -348,10 +349,10 @@ def _tech_section(report: ScanReport) -> RenderableType | None:
     for key in order:
         group = groups[key]
         table.add_row(
-            group.name,
-            group.version or "-",
-            group.category,
-            group.hosts_cell(primary),
+            escape(group.name),
+            escape(group.version or "-"),
+            escape(group.category),
+            escape(group.hosts_cell(primary)),
             group.conf_cell(),
         )
     return table
@@ -425,12 +426,12 @@ def _services_section(report: ScanReport) -> RenderableType | None:
         product = " ".join(filter(None, (port.product, port.version)))
         table.add_row(
             f"{port.port}/{port.protocol}",
-            port.host or "-",
-            _service_cell(product, port.service),
+            escape(port.host or "-"),
+            escape(_service_cell(product, port.service)),
             _sev_text(severity),
         )
     for svc in tech_services:
-        table.add_row("-", "-", _service_cell(svc.name, svc.kind), _sev_text(svc.severity))
+        table.add_row("-", "-", escape(_service_cell(svc.name, svc.kind)), _sev_text(svc.severity))
 
     if report.ports is not None:
         return Group(table, Text(f"via {report.ports.scanner}", style="dim"))
@@ -465,10 +466,10 @@ def _cve_section(report: ScanReport) -> RenderableType | None:
             summary = f"{cve.caveat} — {summary}"
         table.add_row(
             _severity_text(cve),
-            cve.id,
-            affects,
-            where,
-            summary,
+            escape(cve.id),
+            escape(affects),
+            escape(where),
+            escape(summary),
         )
     return table
 
@@ -490,10 +491,16 @@ def _ipinfo_section(report: ScanReport) -> RenderableType | None:
     table.add_column("Source", overflow="fold")
     for info in ordered:
         location = ", ".join(v for v in (info.city, info.country) if v) or "-"
-        org = info.org or info.isp or "-"
+        org = escape(info.org or info.isp or "-")
         if info.is_cdn:
             org = f"{org} [dim](CDN/proxy)[/dim]"
-        table.add_row(info.ip, location, org, info.asn or "-", info.source or "-")
+        table.add_row(
+            escape(info.ip),
+            escape(location),
+            org,
+            escape(info.asn or "-"),
+            escape(info.source or "-"),
+        )
     return table
 
 
@@ -513,7 +520,9 @@ def _creds_section(report: ScanReport) -> RenderableType | None:
             label = Text(" OPEN / NO AUTH ", style="bold white on red")
         else:
             label = Text("auth required", style="dim")
-        table.add_row(finding.target, label, f"{finding.service} — {finding.detail}")
+        table.add_row(
+            escape(finding.target), label, escape(f"{finding.service} — {finding.detail}")
+        )
     return table
 
 
@@ -528,10 +537,10 @@ def _secrets_section(report: ScanReport) -> RenderableType | None:
     for secret in sorted(report.secrets, key=lambda s: s.severity):
         color = theme.SEVERITY.get(secret.severity.upper(), theme.MUTED)
         table.add_row(
-            secret.name,
-            secret.value,
+            escape(secret.name),
+            escape(secret.value),
             Text(f" {secret.severity.upper()} ", style=f"bold {color}"),
-            secret.location or "-",
+            escape(secret.location or "-"),
         )
     return table
 
@@ -549,11 +558,11 @@ def _takeovers_section(report: ScanReport) -> RenderableType | None:
         color = theme.SEVERITY.get(takeover.severity.upper(), theme.MUTED)
         verified = "verified" if takeover.verified else "potential"
         table.add_row(
-            takeover.subdomain,
-            takeover.service,
-            takeover.cname,
+            escape(takeover.subdomain),
+            escape(takeover.service),
+            escape(takeover.cname),
             Text(f" {takeover.severity.upper()} ", style=f"bold {color}"),
-            f"{takeover.evidence} ({verified})",
+            escape(f"{takeover.evidence} ({verified})"),
         )
     return table
 
@@ -575,9 +584,9 @@ def _subdomains_section(report: ScanReport) -> RenderableType | None:
         real = [ip for ip in sub.addresses if ip in report.real_ips]
         real_cell = ", ".join(real) if real else "-"
         if show_real:
-            table.add_row(sub.name, addrs, sub.source, real_cell)
+            table.add_row(escape(sub.name), escape(addrs), escape(sub.source), escape(real_cell))
         else:
-            table.add_row(sub.name, addrs, sub.source)
+            table.add_row(escape(sub.name), escape(addrs), escape(sub.source))
     return table if table.row_count else None
 
 
@@ -655,9 +664,9 @@ def _report_panel(report: ScanReport) -> Panel:
     if report.network is not None:
         ips.extend(report.network.ipv4)
         ips.extend(report.network.ipv6)
-    left = f"[bold]{report.final_url or report.url}[/bold]"
+    left = f"[bold]{escape(report.final_url or report.url)}[/bold]"
     if ips:
-        left += f"\n[dim]{', '.join(ips)}[/dim]"
+        left += f"\n[dim]{escape(', '.join(ips))}[/dim]"
     header.add_row(left, right)
     blocks: list[RenderableType] = [header]
     if report.error:

stackscan/runner.py

@@ -31,7 +31,7 @@ from stackscan.analyzers import TechAnalyzer
 from stackscan.config import build_matchers
 from stackscan.core import StackscanSession
 from stackscan.net import GeoProvider
-from stackscan.scan import ScanOptions, scan_target
+from stackscan.scan import ScanOptions, exc_text, scan_target
 from stackscan.types import ScanReport, Technology
 
 DEFAULT_BACKEND_URL = "http://localhost:8787"
@@ -220,6 +220,7 @@ async def _run(cfg: RunnerConfig) -> None:
 
             async def scan_one(job: dict[str, str]) -> dict[str, Any]:
                 url = job["url"]
+                job_id = job["id"]
                 try:
                     report = await scan_target(
                         url,
@@ -231,10 +232,20 @@ async def _run(cfg: RunnerConfig) -> None:
                         log=None,
                     )
                 except Exception as exc:  # noqa: BLE001 - one bad target must not stop the runner.
-                    report = ScanReport(url=url, error=str(exc))
-                return report_to_result(report, job["id"], cfg.runner_id)
+                    report = ScanReport(url=url, error=exc_text(exc))
+                return report_to_result(report, job_id, cfg.runner_id)
+
+            usable = [job for job in jobs if job.get("url") and job.get("id")]
+            skipped = len(jobs) - len(usable)
+            if skipped:
+                print(f"[!] skipped {skipped} malformed job(s)", flush=True)
+            if not usable:
+                if cfg.once:
+                    return
+                await asyncio.sleep(cfg.idle_seconds)
+                continue
 
-            results = await asyncio.gather(*(scan_one(job) for job in jobs))
+            results = await asyncio.gather(*(scan_one(job) for job in usable))
             try:
                 accepted = await client.report(list(results))
             except Exception as exc:  # noqa: BLE001

stackscan/scan.py

@@ -55,7 +55,7 @@ from stackscan.types import (
     Technology,
     TlsInfo,
 )
-from stackscan.utils import host_of, is_https, is_ip, port_of
+from stackscan.utils import host_of, is_https, is_ip, netloc_of, port_of
 
 if TYPE_CHECKING:
     from stackscan.core import StackscanSession
@@ -72,6 +72,15 @@ def _http_url(host: str, port: int, tls: bool) -> str:
     return f"{scheme}://{host}:{port}"
 
 
+def exc_text(exc: BaseException) -> str:
+    message = str(exc).strip()
+    if message:
+        return message
+    if isinstance(exc, TimeoutError):
+        return "timed out"
+    return exc.__class__.__name__
+
+
 async def _cdn_ips(ips: set[str], *, timeout: float = 8.0, workers: int = 5) -> set[str]:
     import aiohttp
 
@@ -128,7 +137,7 @@ async def _fetch_with_fallback(
             )
         except Exception as exc:
             if first_error is None:
-                first_error = str(exc)
+                first_error = exc_text(exc)
             continue
         return (fetched, attempt)
     report.error = first_error
@@ -372,7 +381,7 @@ async def _scan_site(
             max_bytes=options.max_bytes,
         )
     except Exception as exc:
-        return SiteFinding(url=url, error=str(exc))
+        return SiteFinding(url=url, error=exc_text(exc))
     block_msg = detect_isp_block(url, fetched)
     if block_msg:
         return SiteFinding(url=url, final_url=fetched.url, status=fetched.status, error=block_msg)
@@ -448,7 +457,7 @@ def _collect_site_candidates(report: ScanReport, limit: int) -> list[str]:
         for port in port_scan.ports:
             if port.port not in _HTTP_PORTS:
                 continue
-            host = port.host or report.network.host if report.network else None
+            host = port.host or (report.network.host if report.network else None)
             if not host:
                 continue
             tls = port.port in (443, 8443, 2083) or "https" in (port.service or "").lower()
@@ -989,7 +998,7 @@ async def scan_target(
             report.protocols = _http_protocols(fetched, report.tls)
             stage("scanning page for secrets")
             report.secrets = scan_secrets(
-                fetched.body, location=host_of(fetched.url) if fetched else host or ""
+                fetched.body, location=netloc_of(fetched.url) if fetched else host or ""
             )
             if options.parse_social:
                 stage("extracting social links")

stackscan/scanners/secrets.py

@@ -81,6 +81,29 @@ def _redact(value: str, keep: int = 6) -> str:
     return f"{value[:keep]}...{value[-keep:]}"
 
 
+_PLACEHOLDER_MARKERS: tuple[str, ...] = (
+    "example",
+    "your_",
+    "_here",
+    "changeme",
+    "placeholder",
+    "redacted",
+    "dummy",
+    "sample",
+    "xxxx",
+    "<",
+)
+
+
+def _is_placeholder(value: str) -> bool:
+    """Filter well-known documentation placeholders (e.g. AWS's AKIA...EXAMPLE)."""
+    lowered = value.lower()
+    if any(marker in lowered for marker in _PLACEHOLDER_MARKERS):
+        return True
+    stripped = value.strip("*")
+    return len(set(stripped)) <= 1
+
+
 def scan_secrets(body: str, location: str = "") -> list[SecretFinding]:
     """Return probable secret leaks found in the response body."""
     seen: set[tuple[str, str]] = set()
@@ -89,7 +112,7 @@ def scan_secrets(body: str, location: str = "") -> list[SecretFinding]:
         for match in pattern.regex.finditer(body):
             value = match.group(1) if pattern.regex.groups else match.group(0)
             value = value.strip()
-            if len(value) < 4:
+            if len(value) < 4 or _is_placeholder(value):
                 continue
             key = (pattern.name, value)
             if key in seen:

stackscan/utils/__init__.py

@@ -1,5 +1,5 @@
 from .paths import db_dir
-from .urls import expand_cidr, host_of, is_cidr, is_https, is_ip, normalize_url, port_of
+from .urls import expand_cidr, host_of, is_cidr, is_https, is_ip, netloc_of, normalize_url, port_of
 
 __all__ = [
     "db_dir",
@@ -8,6 +8,7 @@ __all__ = [
     "is_cidr",
     "is_ip",
     "is_https",
+    "netloc_of",
     "normalize_url",
     "port_of",
 ]

stackscan/utils/urls.py

@@ -3,6 +3,8 @@ from __future__ import annotations
 import ipaddress
 from urllib.parse import urlparse
 
+MAX_CIDR_HOSTS = 65536
+
 
 def is_cidr(raw: str) -> bool:
     try:
@@ -14,6 +16,11 @@ def is_cidr(raw: str) -> bool:
 
 def expand_cidr(raw: str) -> list[str]:
     network = ipaddress.ip_network(raw, strict=False)
+    if network.num_addresses > MAX_CIDR_HOSTS:
+        raise ValueError(
+            f"{raw} expands to {network.num_addresses} addresses"
+            f" (limit {MAX_CIDR_HOSTS}); use a smaller prefix"
+        )
     return [str(host) for host in network]
 
 
@@ -36,6 +43,14 @@ def host_of(url: str) -> str:
     return (parsed.hostname or "").lower()
 
 
+def netloc_of(url: str) -> str:
+    parsed = urlparse(url if "://" in url else "https://" + url)
+    host = (parsed.hostname or "").lower()
+    if parsed.port is not None:
+        return f"{host}:{parsed.port}"
+    return host
+
+
 def port_of(url: str) -> int:
     parsed = urlparse(url)
     if parsed.port is not None:

{stackscan-2.7.2.dist-info → stackscan-2.7.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stackscan
-Version: 2.7.2
+Version: 2.7.3
 Summary: Full web stack, infrastructure, DNS, port, subdomain and CVE analyzer.
 Project-URL: Source, https://github.com/reekeer/stackscan
 Project-URL: Issues, https://github.com/reekeer/stackscan/issues
@@ -26,7 +26,6 @@ Requires-Dist: sigdb>=1.0.2
 Provides-Extra: dev
 Requires-Dist: black>=24.0; extra == 'dev'
 Requires-Dist: build>=1.0; extra == 'dev'
-Requires-Dist: cibuildwheel>=2.16; extra == 'dev'
 Requires-Dist: geoip2>=4.8; extra == 'dev'
 Requires-Dist: pyright>=1.1; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'

{stackscan-2.7.2.dist-info → stackscan-2.7.3.dist-info}/RECORD

@@ -1,17 +1,17 @@
-stackscan/__init__.py,sha256=iLyDhPQ-CtYpyB0Cj1Eb-EUM9I0wrNWGLsuXA62wQys,154
+stackscan/__init__.py,sha256=MUquHzamgIKyOfbGzsCOwhtMxgqZHGVuW5QOFjpAj8o,154
 stackscan/__main__.py,sha256=M0ngbLh7EFeMvN_A2pxLpnwpk1xudaIQotUxoguvk_k,88
-stackscan/cli.py,sha256=CBfIDgTYgaNJ57Ru_qeMCiDTmQwF78UOjyT2cKxKEds,47092
+stackscan/cli.py,sha256=Icy5T9_OrcrVlE77l9M3V4hpalDEvPGCYLI7rKf9kX4,47198
 stackscan/embed.py,sha256=S-yT0jJJfK3R6U1FodFnVMTXuvdoRAIhNjvOLiWQoAo,15655
-stackscan/export.py,sha256=TCc9ph6OIju-vhiYd3rLUqRPETrrP0_J2GGXjvXhJvQ,27603
-stackscan/render.py,sha256=4yJKQB4s9n7HmmX_uBZz0dqQh0DUPZJuOOD24mdrik4,26037
-stackscan/runner.py,sha256=2dX7-tS4R_Hy6vtuxpnyoUdf3WwZuCIctNh92a-cS4U,10154
-stackscan/scan.py,sha256=woXuDiGfX9197UZeDts8O7zBv4WMY92zn9eHCP6MyF4,39397
+stackscan/export.py,sha256=RZhRcjzpDN2a9xC8lHIJFmQbx_bYFsvSWANyg7n5ECQ,27958
+stackscan/render.py,sha256=MzF_9FXwoeJ9JhuYEDVYuDBrMNFGSKbaPaKr207cL08,26505
+stackscan/runner.py,sha256=teP15NF4qApWJn7BXGR0q7YHB9bZWyVftqKf-7VyDCU,10592
+stackscan/scan.py,sha256=MPkuGzvNhaAth31Lk_CvKUOy-gjjbRLTY4DTupt6HGs,39634
 stackscan/theme.py,sha256=aykB2Yjjjgekh89Rb872SIRMMWIFP6ANSwLTrwEZ9Dw,900
 stackscan/analyzers/__init__.py,sha256=2DhG7FCOvSJ2OSo_FU16iQ9M74UfiRZLzudSCorPTAE,1051
 stackscan/analyzers/creds.py,sha256=U054T4-njg0Eqpgkq7QSBk_nEZqsgmMqW4KGi0rdePU,12925
-stackscan/analyzers/cve.py,sha256=F0_hl5ePBGtBKh_WCSsovauLSFpUKnnHgkRLdr0Y5HI,19089
-stackscan/analyzers/exposure.py,sha256=wL1VJVxhLhZanwOHG3pockw9pUgb4wejNKAMZCKHnJc,2132
-stackscan/analyzers/generic.py,sha256=ed5-m3lFqzR4QYLpevh_6Fok3jIjDSBhEIWyp7pFpX4,8700
+stackscan/analyzers/cve.py,sha256=F3fJAV8gOZVv8Big-og8R7dUrhApmVhrtwhZO5jLbeA,20049
+stackscan/analyzers/exposure.py,sha256=2f0wY3LoynlrlzzE_tU3drXokLPFVfyKz3MfAGnZ56w,2861
+stackscan/analyzers/generic.py,sha256=aBCBdDNaAMftvWX2B1JRwjgcRVi0_Sk12eMRhi37yyo,9336
 stackscan/analyzers/infra.py,sha256=O6b_oV18ikK86fJsSjXriFKf6jWMVxkEBeO2ZhQM3uY,5922
 stackscan/analyzers/osdetect.py,sha256=E5VN-ajjFAdaRb6Q2gZZvwEMX4YlzJyrNB_JQSS2Ezw,3830
 stackscan/analyzers/security.py,sha256=2Bp1owKVHYcRN3kU_2jX40f4QA5vbB_jg9-88hp7cvs,743
@@ -21,19 +21,19 @@ stackscan/analyzers/tech.py,sha256=aLwsSss2od3Cinl-anfncEm2dpUBUFQLKI6JC0JT1mc,1
 stackscan/analyzers/vibe.py,sha256=K-pR3ysu_2Ho9WTSIUmN0DzQIBaiTaPZ97ozWmv6dKw,6142
 stackscan/config/__init__.py,sha256=Q17mdAjUBdBxciadsZ6_apuGa03w0VdDR9p8ADKS-XM,596
 stackscan/config/sigdb_loader.py,sha256=Honi_wSFDNCgYP3A2o3RsRWZFX_mcCg9Y1B8hiU0ymQ,2261
-stackscan/config/sources.py,sha256=-3CHpu34YvherTLo9KfnfTSINh2Rtu5PcJ9E_FXB49s,14035
+stackscan/config/sources.py,sha256=_kPcT175pYUbFagsGHo88JSrEH8gAiCwStawQJQhI7M,14446
 stackscan/core/__init__.py,sha256=dpYyqXnO3tFU4M5z0mjTAGovO4px6IRwDVtOAl7JKBE,67
-stackscan/core/core.py,sha256=kWSTxTLN131s8RnXkjpwAcNXDyei9BJ6rZdDjQ1C-js,2466
+stackscan/core/core.py,sha256=_rTOyK2eBwWORROfh7gK6usZXwcNsgFnapHkjT9pZr4,2860
 stackscan/data/builtin.sigdb,sha256=DM_pdoRzhUArxl5PDzytCHgP2ia7FaaQ6_9WbE16H7g,1579340
 stackscan/data/cve.json.gz,sha256=LkohNP0Gk66OrgHCuCbNNRESkPXHg150CP_wibszmnI,635760
 stackscan/data/reekeer-logo.png,sha256=usimpkXaxOgnKbGIY6uLpD1Y9uefQYBLJKzBbOI-EV8,8788
 stackscan/data/subdomains.txt,sha256=91RWQUO44BRLWI6eAvo0cSy9MmBOh0EL4ddXYcv7DDg,3894
 stackscan/net/__init__.py,sha256=3LK09_4faQ9NeBjp_wbi7jlBROyZf1aENCmIFslJRWI,781
 stackscan/net/dns.py,sha256=4tPmWexu73e_ZiKme7w_fRsFUEgsKGGogm33jzZM7L4,8034
-stackscan/net/fingerprint.py,sha256=QgzESrldnfJidmDp-ZVrrlN2FyMbdGE65xb7OYue-qo,5069
+stackscan/net/fingerprint.py,sha256=gq_0dsP8d1evhy-cRbwgA8CQgGdcgB7GsJv1o4W3ef4,5245
 stackscan/net/geo.py,sha256=W2Ze5_hpko5R-hULAFdi_SDlSFHC0Ub0KoAA34ffB5o,2225
 stackscan/net/ipinfo.py,sha256=2p0wdBrhhWM1ixScNmWG5cZjLy18NAZb2Na5JARUY0o,2796
-stackscan/net/ports.py,sha256=JVJrfFDCh0R3IuixA1LsNYpWJduFAOXcXWrkLQxrgqA,8134
+stackscan/net/ports.py,sha256=Bz6YCMOjukx9H5zu5PMADiuubH4qELrT3Ulr9igXeSQ,8332
 stackscan/net/resolver.py,sha256=j4gNmxU0KB3ww1p-OycJxu3SY5y__x0Nqu1ODgViLCk,1905
 stackscan/net/subdomains.py,sha256=tiPbpK3dqNhoKKjkl8Gy68puqZt_Es_jxK-tk-drUpM,17120
 stackscan/net/tld.py,sha256=O5RtZggsYB6olQfd5JtEeOtbxGs7DonOSBxKFCWsans,4239
@@ -41,16 +41,16 @@ stackscan/net/tls.py,sha256=aAkWHzyst2fgbdS7ElSvPFF5085Bu5Bke441bsH3gbw,3488
 stackscan/net/whois.py,sha256=mCpozxa92kZBf-f7aLpgzSzVBbCBSoYQNnczpOe9Seg,5947
 stackscan/scanners/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 stackscan/scanners/isp_blocked.py,sha256=yS_qlrozWSH-NdwDjOFdMURXj-cADb4xFJXh4FfKkNA,4313
-stackscan/scanners/secrets.py,sha256=Qr_3cE6rhGrDFWly5JyuCGv0y4RCx4wN00wnuxuaMDc,3458
+stackscan/scanners/secrets.py,sha256=h0RuBrfZ2Cxwc-p6Tkau4DWCP1_amhyTsV0WpQNQo0I,3978
 stackscan/scanners/takeover.py,sha256=P3rnBCkakwuTG00fD0I32lfcfaKS1t48mQtbcaKA1EA,6533
 stackscan/types/__init__.py,sha256=RGFZNxPzHxUuQdwazXgDfXn8mTBveeHlEWxsqSxVLIA,954
 stackscan/types/models.py,sha256=YYVzn8j79Jermhn62CRIRL0OyprDm21ritchffaIuu4,386
 stackscan/types/output.py,sha256=eytLhJhlX4Ah5ALaY8ViCBd8QvMFh-GBeAxHBWUiYIQ,15681
-stackscan/utils/__init__.py,sha256=TBe8TpTO2uipX3YEr9G4nDpqE-bZjcv3iSutwY2r4A4,258
+stackscan/utils/__init__.py,sha256=EW0zbCynB3qxOo2P1C6-hgTXbwCZHXuaFOxRe4-a1vg,286
 stackscan/utils/paths.py,sha256=R1vT7tCwZk1x6yS-R9pETD0qhlsflJR9_MjHDTxdKwg,234
-stackscan/utils/urls.py,sha256=LowDAAZlfxlgZPU-T8BnNJYKSG5V9impeWXyZs2Y3TE,1028
-stackscan-2.7.2.dist-info/METADATA,sha256=ItvtLZHlu-VV9RrCmoW77_a_vW-o_0nE_q_Z4AJTYqo,16544
-stackscan-2.7.2.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-stackscan-2.7.2.dist-info/entry_points.txt,sha256=-wD-04qhZHxoi6M7j1T6Pmgq3cKNoVkWebLvAucSfHY,49
-stackscan-2.7.2.dist-info/licenses/LICENSE,sha256=5Ud3RkJNdrhzBthwtmOMDLx2cGd7wjaGLpi8iHYN2p0,1065
-stackscan-2.7.2.dist-info/RECORD,,
+stackscan/utils/urls.py,sha256=owUr2aoPZqaVnJmUIUZ3SDPVQ1jJlxHg2Mo8UHoNgRQ,1493
+stackscan-2.7.3.dist-info/METADATA,sha256=D3y7PJm5bNeZcsiprQkii2Vf01UiUkhgOSxbvaFMa0c,16494
+stackscan-2.7.3.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+stackscan-2.7.3.dist-info/entry_points.txt,sha256=-wD-04qhZHxoi6M7j1T6Pmgq3cKNoVkWebLvAucSfHY,49
+stackscan-2.7.3.dist-info/licenses/LICENSE,sha256=5Ud3RkJNdrhzBthwtmOMDLx2cGd7wjaGLpi8iHYN2p0,1065
+stackscan-2.7.3.dist-info/RECORD,,